Nexterm up to version 1.2.2-BETA contains a missing authorization check in the server session lifecycle routes. Authenticated users can invoke the hibernate, resume, or delete endpoints to alter the state of other users' remote sessions. An attacker who has a valid session identifier can therefore disrupt active SSH, RDP, VNC, or SFTP connections, causing denial of service or unintentional session termination.

The affected product is Nexterm by gnmyt, specifically versions up to and including 1.2.2‑BETA. The vulnerability resides in the server/routes/serverSession.js file and impacts any deployment that exposes the hibernate, resume, or DELETE session endpoints.

The vulnerability scores a CVSS of 5.3, indicating a moderate risk. The EPSS score is not available, and the entry is not presently listed in the CISA KEV catalog. Since the flaw requires an authenticated user and knowledge of a target session identifier, exploitation typically occurs in environments where multiple users share the same instance of Nexterm. Attackers can use the exposed endpoints to terminate or suspend remote sessions of other users, leading to service disruption. The lack of authorization checks makes it straightforward to perform these actions once the attacker controls a session ID.